CVE-2024-50213

What it actually does

Unfreed allocation from drm_mode_duplicate() inside drm_display_mode_from_cea_vic() causes a kernel memory leak when the drm_hdmi_state_helper_test module is loaded and unloaded.

Why it matters to the business

Repeated execution of kernel unit tests on affected Linux builds can gradually exhaust memory in test or development environments; production systems are unaffected and no ransomware or KEV usage is known.

How an attack unfolds

An attacker would need to repeatedly load and unload the specific DRM HDMI test module to trigger the leak, which is only possible in controlled kernel testing setups and has not been observed in the wild by any listed threat actors.

How to fix it

Update the Linux kernel to a version containing commit 3bc3fae8a0f22e0e713729b50e2111f6a8c64724 or later; for the listed Ubuntu packages apply ruby2.0 2.0.0.484-1ubuntu2.4 or ruby2.3 2.3.1-2~16.04 as appropriate.

How to confirm the fix worked

Confirm the fix by verifying the presence of drm_kunit_display_mode_from_cea_vic() usage or the cited commit; re-run modprobe/rmmod of the test module under kmemleak and ensure no unreferenced objects remain.

Typical attack path

1. Obtain ability to load kernel modules (typically root)
2. modprobe drm_hdmi_state_helper_test
3. rmmod drm_hdmi_state_helper_test
4. Repeat to accumulate unreferenced allocations

How to detect it

Inspect kmemleak reports after loading/unloading drm_hdmi_state_helper_test for unreferenced objects allocated via drm_mode_duplicate; no production exploitation artifacts are expected.

What your security team should do

• Apply the listed fixed kernel or package versions on all development and test systems
• Monitor EPSS (currently stable at 0.00202) and re-evaluate if new exploit code appears
• Disable or remove the drm_hdmi_state_helper_test module from production kernels